[zglicz]

Build-number allocation fails with HTTP 403 on sonar-plugin-api PR #336 despite contents: write. A diagnostic using the same job token could create a bookkeeping ref targeting the PR head, but GitHub rejected the synthetic merge commit and each older commit tested: https://github.com/SonarSource/sonar-plugin-api/actions/runs/39421989592.

Default bookkeeping refs to the PR head for pull requests, retaining the workflow SHA for other events. Add an optional ref-sha input so callers can choose the target explicitly. Ref targets are never read by the allocator, and the build checkout and commit metadata remain unchanged.

Validation: all 19 focused ShellSpec tests and ShellCheck pass, including a regression that checks the supplied SHA is used for lock, number, and run-marker refs. End-to-end validation: SonarSource/sonar-plugin-api#336 allocated number 5607 against its PR head and passed its full Gradle build and SonarQube analysis while checking out the merge commit: https://github.com/SonarSource/sonar-plugin-api/actions/runs/39422587344. All checks on this PR also pass, including the full shell suite and Linux/Windows allocator integration tests.

[hashicorp-vault-sonar-prod]

PREQ-9534

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review 👍 Approved with suggestions 0 closed / 1 findings

🟡 Medium risk · Targeting bookkeeping refs at the PR head or an optional SHA could make build-number allocation fail when that commit cannot be accepted.

Defaults bookkeeping refs to the PR head for pull requests and adds an optional ref-sha input so callers can pick the target explicitly, leaving the checkout and commit metadata unchanged. Approved with suggestions: a minor open finding notes this conflicts with #360's ref-target rule (both change the sha= argument of create_ref()), so the two need to be reconciled before merging together.

💡 [cross-pr] Conflicts with #360's ref-target rule; one side's tests and input break

📄 get-build-number/get_build_number.sh:35 📄 get-build-number/action.yml:9-11 📄 get-build-number/action.yml:66 📄 spec/get_build_number_spec.sh:24-38

Breaks when this PR is reopened and merged into master alongside #360, and both change the sha= argument of create_ref().

How

1. This PR sends sha=${BUILD_NUMBER_REF_SHA:-$GITHUB_SHA} (get-build-number/get_build_number.sh:35). It is fed from a new ref-sha input that defaults to the PR head (get-build-number/action.yml:9-11,66).
2. BUILD-12998 Fix build-number ref authorization for PR merge commits #360 changes the same line to sha=${REF_TARGET_SHA} (get-build-number/get_build_number.sh:36). That value is resolved once from commits/HEAD (the default-branch head). BUILD-12998 Fix build-number ref authorization for PR merge commits #360 has no ref-sha input and does not pass BUILD_NUMBER_REF_SHA.
3. If BUILD-12998 Fix build-number ref authorization for PR merge commits #360's line wins, this PR's ref-sha input and README table describe an option that has no effect. Its new spec also fails, because the mocked gh returns 1 unless sha=${BUILD_NUMBER_REF_SHA} is sent (spec/get_build_number_spec.sh:31).
4. If this PR's line wins, BUILD-12998 Fix build-number ref authorization for PR merge commits #360's default-head targeting and its specs that expect sha=<default-head> fail. Combining both also adds a commits/HEAD call that this PR's mock doesn't expect.

Fix

• This PR: Choose one ref-target rule together with BUILD-12998 Fix build-number ref authorization for PR merge commits #360. If the ref-sha override stays, make it take priority over BUILD-12998 Fix build-number ref authorization for PR merge commits #360's resolved default-branch head, and update the spec mocks to handle the commits/HEAD lookup.
• BUILD-12998 Fix build-number ref authorization for PR merge commits #360: Add an optional override (for example, BUILD_NUMBER_REF_SHA/ref-sha) that skips the commits/HEAD lookup when it is set. Otherwise, close one of the two PRs so only one strategy lands.

Compared 9ecc067 with #360 at 984ec6f

🤖 Prompt for agents

Code Review: Defaults bookkeeping refs to the PR head for pull requests and adds an optional `ref-sha` input so callers can pick the target explicitly, leaving the checkout and commit metadata unchanged. Approved with suggestions: a minor open finding notes this conflicts with #360's ref-target rule (both change the `sha=` argument of `create_ref()`), so the two need to be reconciled before merging together.

1. 💡 [cross-pr] Conflicts with [#360](<https://github.com/SonarSource/ci-github-actions/pull/360>)'s ref-target rule; one side's tests and input break
   Files: get-build-number/get_build_number.sh:35, get-build-number/action.yml:9-11, get-build-number/action.yml:66, spec/get_build_number_spec.sh:24-38

   **Breaks when** this PR is reopened and merged into master alongside #360, and both change the `sha=` argument of `create_ref()`.
   
   **How**
   
   1. This PR sends `sha=${BUILD_NUMBER_REF_SHA:-$GITHUB_SHA}` (`get-build-number/get_build_number.sh:35`). It is fed from a new `ref-sha` input that defaults to the PR head (`get-build-number/action.yml:9-11,66`).
   2. #360 changes the same line to `sha=${REF_TARGET_SHA}` (`get-build-number/get_build_number.sh:36`). That value is resolved once from `commits/HEAD` (the default-branch head). #360 has no `ref-sha` input and does not pass `BUILD_NUMBER_REF_SHA`.
   3. If #360's line wins, this PR's `ref-sha` input and README table describe an option that has no effect. Its new spec also fails, because the mocked `gh` returns 1 unless `sha=${BUILD_NUMBER_REF_SHA}` is sent (`spec/get_build_number_spec.sh:31`).
   4. If this PR's line wins, #360's default-head targeting and its specs that expect `sha=<default-head>` fail. Combining both also adds a `commits/HEAD` call that this PR's mock doesn't expect.
   
   **Fix**
   
   - **This PR:** Choose one ref-target rule together with #360. If the `ref-sha` override stays, make it take priority over #360's resolved default-branch head, and update the spec mocks to handle the `commits/HEAD` lookup.
   - **#360:** Add an optional override (for example, `BUILD_NUMBER_REF_SHA`/`ref-sha`) that skips the `commits/HEAD` lookup when it is set. Otherwise, close one of the two PRs so only one strategy lands.
   
   _Compared `9ecc067` with #360 at `984ec6f`_

Verification Rules 2/2 met Repos 4 inspected · PRs 3 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 4 inspected PRs 3 inspected

Cross-repo 4 repositories inspected 0 open impacts

SonarSource/reddeer Inspected
SonarSource/sonar-scanner-cli-docker Inspected
SonarSource/sonar-packaging-maven-plugin Inspected
SonarSource/sonar-scanner-azdo Inspected

Cross-PR 3 PRs inspected 1 open impact

PR #360: BUILD-12998 Fix build-number ref authorization for PR merge commits Inspected
PR #344: PLUGINAPI-249 Keep build-number workaround local to sonar-plugin-api Inspected
PR #413: CLP-1073: Bump CI Actions and grant contents:write to config-gradle/build-gradle v2 jobs Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

💡 [cross-pr] Conflicts with #360's ref-target rule; one side's tests and input break

Breaks when this PR is reopened and merged into master alongside #360, and both change the sha= argument of create_ref().

How

1. This PR sends sha=${BUILD_NUMBER_REF_SHA:-$GITHUB_SHA} (get-build-number/get_build_number.sh:35). It is fed from a new ref-sha input that defaults to the PR head (get-build-number/action.yml:9-11,66).
2. BUILD-12998 Fix build-number ref authorization for PR merge commits #360 changes the same line to sha=${REF_TARGET_SHA} (get-build-number/get_build_number.sh:36). That value is resolved once from commits/HEAD (the default-branch head). BUILD-12998 Fix build-number ref authorization for PR merge commits #360 has no ref-sha input and does not pass BUILD_NUMBER_REF_SHA.
3. If BUILD-12998 Fix build-number ref authorization for PR merge commits #360's line wins, this PR's ref-sha input and README table describe an option that has no effect. Its new spec also fails, because the mocked gh returns 1 unless sha=${BUILD_NUMBER_REF_SHA} is sent (spec/get_build_number_spec.sh:31).
4. If this PR's line wins, BUILD-12998 Fix build-number ref authorization for PR merge commits #360's default-head targeting and its specs that expect sha=<default-head> fail. Combining both also adds a commits/HEAD call that this PR's mock doesn't expect.

Fix

• This PR: Choose one ref-target rule together with BUILD-12998 Fix build-number ref authorization for PR merge commits #360. If the ref-sha override stays, make it take priority over BUILD-12998 Fix build-number ref authorization for PR merge commits #360's resolved default-branch head, and update the spec mocks to handle the commits/HEAD lookup.
• BUILD-12998 Fix build-number ref authorization for PR merge commits #360: Add an optional override (for example, BUILD_NUMBER_REF_SHA/ref-sha) that skips the commits/HEAD lookup when it is set. Otherwise, close one of the two PRs so only one strategy lands.

Compared 9ecc067 with #360 at 984ec6f

_{Was this helpful? React with 👍 / 👎}